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DETAILED ACTION 

1. This action is responsive to the communication filed on October 09, 2007. 
Claims 1-86 are pending. At this time, claims 1, 3-40, 42, 44-55, 57-67, 69-70, and 72, 
74-85 are still rejected. 

Response to Arguments 

2. Applicant's arguments filed October 09, 2007 have been fully considered 
and are persuasive. Therefore, the rejection has been withdrawn. However, upon 
further consideration, a new ground(s) of rejection is made in view of Roesch et al (US 
7,240,368 B1). 

Election/Restrictions 

3. Applicant's election with traverse of Species 1 in the reply filed on May 
01, 2007 is acknowledged. 

Claims 41, 56, 71, and 86 are withdrawn by the applicant from further 
consideration pursuant to 37 CFR 1.142(b) as being drawn to a nonelected species 2. 
Election was made with traverse in the reply filed on May 01, 2007. This is not found 
persuasive because each of the various disclosed species details a mutual exclusive 
characteristic of: 

Species 1 is drawn to "A method, a system, and a computer-readable 
medium comprising: determining whether a source address for a first packet sent by the 
source address to a destination address qualifies as a threat; examining the first packet; 
and determining a response to the first packet based upon the examining and based 
upon whether the source address qualifies as the threat." 

Species 2 is drawn to "A method, a system, and a computer-readable 
medium comprising: examining a first packet sent by a source address to a destination 
address; determining whether the destination address is a synthetic hardware address; 
and when the destination address is the synthetic hardware address, modifying the first 
packet by replacing the destination address with a hardware address for a device to 
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receive communication targeted to the destination address, and sending the first 
packet." 

These above individual species act as evidenced by the representation of 
each various species with a different figure or set of figures and a different in processing 
the steps. 

A search for one of these mutually exclusive characteristics is not 
coextensive with a search for the other mutually exclusive characteristics and therefore 
searching for all mutually exclusive characteristics could not be done without serious 
burden. The requirement is still deemed proper and is therefore made FINAL. 

Claim Rejections - 35 USC § 101 

4. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition 
of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

5. Claims 1, 3-40, 42, 44-55, 57-67, 69-70, and 72, 74-85 are rejected under 
35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. 

a. Referring to claim 72: 

i. Claim 72 recites "A tangible computer-readable medium 
comprising: threat-determining instructions configured to determine whether a source 
address for a first packet sent by the source address to a destination address qualifies 
as a threat; examining instructions configured to examine the first packet; synthetic- 
address-determining instructions configured to determine whether the destination 
address is synthetic; and response-determining instructions configured to determine a 
response to the first packet based upon the examining and whether the source address 
qualifies as the threat." The claim is directed toward a software program, and this is a 
non-statutory subject matter. Furthermore, applicant has pointed out in the specification 
(see paragraph 0116 of page 22 of specification) "The instructions 338 may include 
various operating instructions and computer-implemented instructions for 
implementing the methods herein, among others. These instructions may take the 
form of interpretive instructions, programs, and additional data, among others .". 
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which clearly including intangible media such as signals, carrier waves, transmissions, 
optical waves, transmission media or other media incapable of being touched or 
perceived absent the tangible medium through which they are conveyed. Therefore, 
claim 72 recites a non-statutory subject matter. 

b. Referring to claims 1, 42, 57: 

i. These claims consist a method and a system to implement 
claim 72, thus they are rejected with the same rationale applied against claim 72 above. 

c. Referring to claims 3-39, 44-55, 58-67. 69-70, 74-85: 

i. These claims are dependent claims of either 1, 42, 57, and 
72, thus they are rejected with the same rationale applied against claims 1, 42, 57, and 
72 above. 

Claim Rejections - 35 USC § 103 

6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to'be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 1, 3-36, 39-40, 42, 44-55, 57-67, 69-70, 72, 74-85, are rejected 
under 35 U.S.C. 103(a) as being unpatentable over Trcka et al (US 6,453,345 B2), and 
further in view of Roesch et al (US 7,240,368 B1 ). 

a. Referring to claim 1: 

i. Trcka teaches a computer-implemented method comprising: 
(1) determining whether a source address for a first 
packet sent by the source address to a destination address qualifies as a threat, and 
when the source address qualifies as the threat, determining whether the destination 
address is synthetic (column 14, lines 61-67; column 15, lines 36-57 of Trcka); 
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(2) examining the first packet (column 15, line 58 
through column 16, line 4 of Trcka); and 

(3) determining a response to the first packet based upon 
the examining and based upon whether the source address qualifies as the threat 
(column 15, line 58 through column 16, line 4 of Trcka). 

ii. Although Trcka teaches the claimed subject matter, Trcka is 
silent on the capability of determining whether the destination address is synthetic. On 
the other hand, Roesch teaches this limitation in column 7, lines 1-3 of Roesch. 

iii. It would have been obvious to a person having ordinary skill 
in the art at the time the invention was made to: 

(1) have modified the invention of Trcka with the teaching 
of Thubert for detecting and protecting against security breaches (both internal and 
external), network failures, and other types of data-compromising events (column 1, 
lines 12-15 of Trcka). 

iv. The ordinary skilled person would have been motivated to: 

(1) have modified the invention of Trcka with the teaching 
of Thubert to monitor and record the traffic present on a local area network, wide area 
network, or other type of computer network, without interrupting or otherwise interfering 
with the flow of the traffic (see Trcka's abstract, lines 1-5). 

b. Referring to claim 21: 

i. Trcka further teaches: 

(1) when the source address fails to qualify as the threat, 
determining whether the destination address qualifies as a second threat (column 14, 
lines 61-67; column 15, lines 36-57 of Trcka). 

c. Referrinp to claim 26: 

i. Trcka further teaches: 
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(1) when the source address qualifies as the threat, 
determining a packet type of the first packet (column 14, lines 61-67; column 15, lines 
36-57; and column 18, lines 3-7 of Trcka). 

d. Referring to claim 27: 

i. Trcka further teaches: ' 

(1) when the packet type of the first packet is an address 
resolution protocol request (column 1, lines 45-48; column 2, lines 49-56; and 
column 7, lines 57-67 of Trcka), determining that the response comprises creating a 
reply comprising the destination address as a reply source address, and sending the 
reply to the source address (column 15, line 36 through column 16, line 4 of Trcka). 

e. Referring to claim 28: 

i. This claim has limitations that is similar to those of claim 27, 
thus it is rejected with the same rationale applied against claim 27 above. 

f. Referring to claim 36: 

i. Trcka further teaches: 

(1) performing the response (column 14, lines 61-67; 
column 15, lines 36-57 of Trcka). 

g. Referring to claim 39: 

i. Trcka further teaches: 

(1) wherein the examining the first packet comprises 
examining a header for the first packet (column 6, lines 13-16; column 16, lines 49-55 
of Trcka). 

h. Referring to claim 40: 

i. Trcka further teaches: 

(1) wherein the examining the first packet does not 
comprise examining a payload for the first packet (column 18, lines 3-14 of Trcka). 

i. Referring to claims 42. 57. 72: 
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i. These claims consist a system and computer-readable 
medium to implement claim 1, thus they are rejected with the same rationale applied 
against claim 1 above. 

j. Referring to claims 50, 80: 

i. These claims have limitations that is similar to those of claim 
1 , thus they are rejected with the same rationale applied against claim 1 above. 

I. Referring to claims 53, 85: 

i. These claims have limitations that is similar to those of claim 

26, thus they are rejected with the same rationale applied against claim 26 above. 

m. Referring to claims 54, 69: 

i. These claims have limitations that is similar to those of claim 

27, thus they are rejected with the same rationale applied against claim 27 above. 

k. Referring to claims 55, 70: 

i. These claims have limitations that is similar to those of claim 
36, thus they are rejected with the same rationale applied against claim 36 above. 

I. Referring to claim 3: 

i. The combination of teaching between Trcka and Roesch 
teaches the claimed subject matter. Roesch and Trcka further teach: 

(1) when the destination address is determined to be 
synthetic (column 7, lines 1-3 of Roesch), determining the response to be dropping 
the first packet (column 1, lines 46-48 of Roesch; column 20, lines 40-67 of Trcka). 
m. Referring to claim 4: 

i. The combination of teaching between Trcka and Roesch 
teaches the claimed subject matter. Roesch and Trcka further teaches: 

(1) dropping the first packet (column 1, lines 46-48 of 
Roesch; column 20, lines 40-67 of Trcka). 

n. Referring to claim 5: 
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i. The combination of teaching between Trcka and Roesch 
teaches the claimed subject matter. Trcka further teaches: 

(1) when the destination address is determined to be not 
synthetic and the source address is the threat (column 14, lines 61-67; column 15, 
lines 36-57 of Trcka), determining whether the source address is on a local network 
(column 2, lines 11-14 of Trcka). 

o. Referring to claim 22: 

i. This claim has limitations that is similar to those of claims 1- 
3, thus it is rejected with the same rationale applied against claims 1-3 above, 
p. Referring to claim 23: 

i. This claim has limitations that is similar to those of claim 4, 
thus it is rejected with the same rationale applied against claim 4 above, 
q. Referring to claims 44-46, 59-61. 74-76: 

i. These claims have limitations that is similar to those of 
claims 2-5, thus they are rejected with the same rationale applied against claims 2- 
Sabove. 

r. Referring to claims 51. 58, 81: 

i. These claims have limitations that is similar to those of claim 
2, thus they are rejected with the same rationale applied against claim 2 above, 
s. Referring to claims 52. 82: 

i. These claims have limitations that is similar to those of claim 
27, thus they are rejected with the same rationale applied against claim 27 above. 

8. Claims 37-38 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Trcka et al (US 6,453,345 B2), in view of Roesch et al (US 7,240,368 B1, and 
further in view of Miyazaki et al (US 5,517,488). 

a. Referring to claims 37-38: 

i. The combination of teaching between Trcka and Roesch 
teaches the claimed subject matter. Trcka further teaches: 
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(1) wherein the source address comprises at least one of 
a logical address and a physical address (column 18, lines 3-7 of Trcka). 

ii. Although Trcka and Roesch teach the source and 
destination addresses, they are silent on the capability of showing source address 
and/or destination address includes the logical and physical addresses. On the other 
hand, Miyazaki teaches this limitation in Figures 3, 5, 6A-6B, and 8. 

iii. It would have been obvious to a person having ordinary skill 
in the art at the time the invention was made to: 

(1) have modified the modified-invention of Trcka with the 
teaching of Miyazaki for detecting and protecting against security breaches (both 
internal and external), network failures, and other types of data-compromising events 
(column 1, lines 12-15 of Trcka). 

iv. The ordinary skilled person would have been motivated to: 

(1 ) have modified the modified-invention of Trcka with the 
teaching of Miyazaki to monitor and record the traffic present on a local area network, 
wide area network, or other type of computer network, without interrupting or otherwise 
interfering with the flow of the traffic (see Trcka's abstract, lines 1-5). 

Conclusion 

9. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to Thanhnga (Tanya) Truong 
whose telephone number is 571-272-3858. 

If attempts to reach the examiner by telephone are unsuccessful, 
the examiner's supervisor, Kim Vu can be reached at 571-272-3859. The fax and 
phone numbers for the organization where this application or proceeding is assigned is 
571-273-8300. 
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Any inquiry of a general nature or relating to the status of this 
application or proceeding should be directed to the receptionist whose telephone 
number is 571-272-2100. 



TBT 




January 21, 2008 




